Hi All,

I have RHQ 4.14.0 + LDAP and the role mapping is failing.

The RHQ log for login action:

17:12:05,065 INFO  [org.rhq.enterprise.server.auth.SubjectManagerBean] (http-/0.0.0.0:7080-13) Letting in user [hmolina]  without any assigned roles.
17:12:05,297 INFO  [org.rhq.enterprise.server.auth.SubjectManagerBean] (http-/0.0.0.0:7080-13) Letting in user [hmolina]  without any assigned roles.
17:12:06,851 INFO  [org.rhq.enterprise.server.auth.SubjectManagerBean] (http-/0.0.0.0:7080-3) Letting in user [hmolina]  without any assigned roles.

The LDAP log for RHQ group search:

[29/Nov/2016:17:12:06 -0300] conn=1272 op=1 SRCH base="cn=accounts,dc=example,dc=com" scope=2 filter="(&(objectClass=groupOfNames)(member=hmolina))" attrs="cn description"

The TestLdapSetting.jar tool shows the follow LDAP search with same setings:

STEP-4:TESTING: Using Group Search Filter '(&(objectclass=groupOfNames)(member=uid=hmolina,cn=users,cn=accounts,dc=example,dc=com))', 4 ldap group(s) were located.

The LDAP log for TestLdapSetting.jar group search:

[29/Nov/2016:17:48:39 -0300] conn=1395 op=1 SRCH base="cn=accounts,dc=example,dc=com" scope=2 filter="(&(objectClass=groupOfNames)(member=uid=hmolina,cn=users,cn=accounts,dc=example,dc=com))" attrs="cn description"

In short, RHQ has truncated the filter.

Right filter (TestLdapSetting.jar):
'(&(objectclass=groupOfNames)(member=uid=hmolina,cn=users,cn=accounts,dc=example,dc=com))'

Wrong filter (RHQ):
"(&(objectClass=groupOfNames)(member=hmolina))"

Regrads,

Henry.